Malicious Code Detected in react-native-kraken-oauth: A Security Threat
Summary
MAL-2025-6806: Malicious code in react-native-kraken-oauth (npm). Affects react-native-kraken-oauth versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'react-native-kraken-oauth' package is a library designed for integrating Kraken OAuth authentication into React Native applications. It allows developers to authenticate users via the Kraken platform, providing a seamless user experience. However, version 1.0.1 of this package has been identified as malicious, posing significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability originates from the package's communication with a domain associated with malicious activity. This could lead to unauthorized data access, data breaches, or other malicious actions that compromise user security and application integrity. The technical aspect of this vulnerability lies in the package's ability to send sensitive information to an external server without user consent.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall react-native-kraken-oauthIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As an immediate workaround, consider removing the 'react-native-kraken-oauth' package from your project until a secure version is released. You can do this by running: npm uninstall react-native-kraken-oauth. Additionally, you may want to explore alternative libraries for OAuth integration that do not have known vulnerabilities.
Conclusion
The 'react-native-kraken-oauth' package has been flagged for malicious activity, posing a serious threat to applications that utilize it. It is crucial for developers to update or remove the package and consider using alternative solutions to maintain application security. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for react-native-kraken-oauth →
FAQ
The vulnerability involves the package communicating with a domain linked to malicious activities, which can compromise user data.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your package-lock.json file to the Vulert playground at Vulert Scanner to check for vulnerabilities.
As of now, the malicious version identified is 1.0.1. Check the package repository for any updates or patches that may address this issue.
If immediate updates are not possible, consider removing the package and using alternative libraries for OAuth integration until a secure version is available.
Vulert uses your package-lock.json file to monitor and alert you in real-time for open-source vulnerabilities, ensuring your application remains secure.
